Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 7 Jul 2023 16:28:51 -0400
From:   Joe Korty <joe.korty@concurrent-rt.com>
To:     Waiman Long <longman@redhat.com>
Cc:     linux-kernel@vger.kernel.org,
        Peter Zijlstra <peterz@infradead.org>,
        Ingo Molnar <mingo@kernel.org>
Subject: [BUG 6.4] sched/core: Possible buffer overflow in do_set_cpu_allowed
Message-ID: <20230707202851.GA4231@zipoli.concurrent-rt.com>
Reply-To: Joe Korty <joe.korty@concurrent-rt.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.21 (2010-09-15)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?6nyuKWETujjLiGUstHSRoZFvznzKRg242Cy/8GNS7tJzROVEAAh0KdikyGQV?=
 =?us-ascii?Q?ckEj0GsKJ/q8R/VMf4CiqNT6rZHXG5KDX8XqMkQS2dV31ZYgUwTTqcONQOCH?=
 =?us-ascii?Q?RLz3NZozZD77TM7015ANXnvTREKXGIJqmWbBi+ZR8qmAKty+JjOocb9eU8Py?=
 =?us-ascii?Q?kxneKKTKIUnJ1BRSpSRyFUVkh0P9SdFu8AQhEB0HdZn31HHu2G7/95re/tBt?=
 =?us-ascii?Q?/EPkZ3iGsl1/Ga9ZVVwFM8/VgSP18RlNTDe1Rv8NShTvYX+K2E2cBUU68PVq?=
 =?us-ascii?Q?lQDWp2cQdSQR8BbtMdUTR/qdIwxEqxk0x6Csa3YyNuCUwGfMAWpD/J8E0Bwl?=
 =?us-ascii?Q?qDrnYrTp4v5jZS55JhoXKQxMOWCagc26kCBHW5iOrfMNVXwiFUbAe0tBWKhz?=
 =?us-ascii?Q?tVnsBdf+H3AEsFgMVNOFbAsUwXVzWDryR9y0xpHWSqNGAaA+n/QGRUw6wkwm?=
 =?us-ascii?Q?BXRyjjmUTkKLeQ7RBKCbZzoBJ0lhkhaAI2EIoNe7ROuuvml8enril3j+sY2w?=
 =?us-ascii?Q?Y4JFcQq0p0V5Vn5LEuZ0QXm+M74moyGR0tk8c9xZ7Bx48mXgOGhSLvq8GcRp?=
 =?us-ascii?Q?GY3FXVPQXWe8igkLIkvPU6EUusdaMITcZe171/1DFxlaIgXfCl572AbVRSo5?=
 =?us-ascii?Q?jXPmrHvqivYcWf38k12o24o4Pc+JT5wDLpaksQl042SmEqL1QJ9/mq3EMg1I?=
 =?us-ascii?Q?vSBlfOu3XxdikPqba6iKZPXc4LEBdZ+MgZuF0kL/jMFI5DGr3jQoL+W1sfkC?=
 =?us-ascii?Q?lJrOEUDpoUsBtaQEK1b29FtRV0mIh2VYu9ZsdohlSgMoBz84ulfpPTKHNYIY?=
 =?us-ascii?Q?fCoanvmTNLzNSBLYadATMkRbDNfnxbZXArWELZ94RyMquJgA7KjgCX4Q96fA?=
 =?us-ascii?Q?/m5B7VbBEzbg7asvuRiIFXNybz4thnbGutuZZFl/IvXLLe30LVNsYze0F7Fs?=
 =?us-ascii?Q?uuPPaIVoEFpjZEzh8gU5zf4UeEB1O8D0mL1uN+AsX46fyfCRi1uYP+zXY779?=
 =?us-ascii?Q?xyMEcMkUWxrQRZEMTfjg6daPnrgdz5KeDk6ZWlQ3GGSmIKN567HCZYleYpdt?=
 =?us-ascii?Q?F9nN7qPJ7m/+tc5UJ7vGhg3OFKeMgdi+XFxm77D704Fr8clHl0irzF+vUU1N?=
 =?us-ascii?Q?UiN74UMjGIrT6k2lEkNUWgtM07ClChMx4o648hWJKmMKEzeoXwHR4kIn9X4J?=
 =?us-ascii?Q?pVllau96pdwdkIa+KLKbXA3rP66ZvF127MI2pw/Ugp4AgzmHR8SYiHVFSaWh?=
 =?us-ascii?Q?UTwVRofIzAs3igO9yPf6A6YBe9K+zZmix6w8CLnHcoMG4z3+TyhnfQI51L6p?=
 =?us-ascii?Q?GBGkFDhgRonv8Mpi/uyx5S9xtf1xXGzZAj/WKi5jigGKhb7+IoA21kJHqSU3?=
 =?us-ascii?Q?6LqCtGIgn1Dz6m2qrFOiTG3emoGFTE5A/crdtHtnvtSnEX7LIKXIXm4JnGz9?=
 =?us-ascii?Q?MeDFO64sFhwHVy4+Au+qYKNTbc6bcmOEM4LCip2yL4JKMHkY7rYDXqCYfgwS?=
 =?us-ascii?Q?t8W2owKgEVR1iwQHkdJS14NWOqHpvkMJLdQt2fhO2ZT6fP27p/+aHp+ElIGi?=
 =?us-ascii?Q?YaQM0aTtIFZj+6f3gHUhnnQvn+C/iAVLAb7M/bWPyJU1qve4RdfRqfsuRytn?=
 =?us-ascii?Q?Sw=3D=3D?=
X-OriginatorOrg: concurrent-rt.com
X-MS-Exchange-CrossTenant-Network-Message-Id: ecdf80bb-00e5-495e-d2a9-08db7f28cb09
X-MS-Exchange-CrossTenant-AuthSource: VI1PR09MB3582.eurprd09.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jul 2023 20:28:58.6620
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 6cce74a3-3975-45e0-9893-b072988b30b6
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: sqhUenYkPexAT1jb+7FNP4wcnLRBymIpcUAyysSF4G7mQTXvOTKXVAAxoaphaEzMdy9dXWqvM/pJCngYb4dOcGdT+2KCQug2j5h+4Re2Awk=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR09MB5371
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

In commit 9a5418bc48bab ("sched/core: Use kfree_rcu() in
do_set_cpus_allowed()"), a kfree_rcu() is used to free a cpu mask.
However, cpu masks can be as short as 8 bytes and this is a problem,
as kfree_rcu requires the to-be freed buffer to be at least 16 bytes.
Thus there is a chance of buffer overflow corruption when the number of
possible cpus in the system is 64 or less.

I have not seen this corruption in the wild.  I only noticed this possibility
when reviewing the scheduler differences between 6.1 and 6.4.

Regards,
Joe Korty